Cloudflare's Q3 DDoS report counts 18.2 million network layer attacks, 96% under 10 minutes: what it measures

18.2 million is a count, and three different comparisons travel with it

Cloudflare's DDoS Threat Report for 2026 Q3, published on 29 October 2026, says Cloudflare autonomously mitigated 18.2 million network layer DDoS attacks in the quarter. The post puts that at about 8,226 an hour, and says 96 percent of the attacks ended in under 10 minutes. Set against the second quarter's 13.2 million, read from the post's own chart, the quarter's count is 37.9 percent higher (derived). The post does not print that figure. It prints a different comparison, plus 208 percent on the same quarter of 2025, and the base for it sits in Cloudflare's 2025 Q3 post: 5.9 million network layer attacks, which gives 208.5 percent (derived).

What that does not establish is anything beyond Cloudflare's own network. The figures are attacks that Cloudflare counted and stopped for the traffic it carries. The post gives no total of all attacks, no number of customers, no definition of what counts as one attack, and nothing about networks Cloudflare does not protect. Cloudflare sells DDoS protection and related network services, measures only its own network, and is the only source for every figure here; no outside party has checked them.

This briefing reads the whole Cloudflare post, its eight images and the two earlier editions it builds on, from 11:29 GMT on Saturday 31 October 2026. Two pages the post points to could not be read by script: the Cloudflare Radar page answers with a browser check, and the US Department of Justice release about the botnet action answers with a verification page. Neither was bypassed. A press headline of 31 October is not used for any figure here.

Six numbers, six different things

The post's section title says "8,200 DDoS attacks every hour". The body is narrower: the rate is about 8,226 network layer attacks an hour, about 197,400 a day, "one attack every 0.44 seconds". The same quarter's HTTP figure is 14.4 trillion requests, which is a count of requests and not of attacks, so no single total of attacks across both layers is printed. The diagram sets each headline number against what it counts and what it is compared with.

Zoom

Three of these need care. First, the hourly rate is an average over 92 days, and the quarter was not even. The post's own chart gives August 41.5 percent of the quarter's network layer attacks, July 26.6 percent and September 31.9 percent, so August averaged about 10,150 attacks an hour and July about 6,500 (derived). Second, the 2025 report's rate of about 3,780 attacks an hour counted network and HTTP attacks together, so it cannot be set beside 8,226. Like for like, the 5.9 million network layer attacks of Q3 2025 are about 2,670 an hour (derived). Third, the HTTP layer has no year on year base at all: the 2025 report counted 2.4 million HTTP attacks, and the 2026 post counts requests. The chart in the post gives 16.9 trillion HTTP requests for Q2, so the third quarter's 14.4 trillion is 15 percent lower (derived). The post does not comment on that fall.

There is also a wording problem with the 208 percent. The key insights paragraph attaches it to short burst, low bandwidth attacks, those lasting under 10 minutes and 1 Gbps. The body attaches the same figure to all 18.2 million attacks, then lists the two shares below it: 96 percent ended in under 10 minutes and 98 percent stayed under 1 Gbps. Because 96 and 98 together leave at most 6 percent outside either bucket, at least 94 percent of the attacks were both short and small, about 17.1 million (derived). The two readings therefore land close together, and the arithmetic against the 2025 base supports the body's reading: the 208 percent is the change in all network layer attacks.

Zoom

More swarms, fewer giants: what the two words are made of

The post never defines a swarm or a giant. Its buckets are these: short means ending in under 10 minutes, small means under 1 Gbps, and the giants are network layer attacks above 1 Tbps. By count, the swarm is almost everything: 96 percent under 10 minutes is about 17.5 million attacks, and about 0.7 million ran 10 minutes or longer (derived from the rounded percentage). A year earlier, 89 percent of network layer attacks ended in under 10 minutes, per the 2025 post, and the half year report gave 90.6 percent for the first half of 2026. Applied to the 2025 base, about 0.65 million attacks lasted 10 minutes or longer in Q3 2025 (derived), against about 0.7 million now. The rounding allows a range, but on these figures almost all of the growth is in attacks that end within 10 minutes.

The giants fell, by the post's own count, to 251 attacks above 1 Tbps in the quarter from 805 in Q2, a drop of 68.8 percent (derived), which the post rounds to "nearly 69%". The half year report adds the earlier base: 935 such attacks across the first half. That leaves about 130 in Q1 (derived), so Q3's 251 is still roughly twice Q1. Against the 18.2 million attacks of the quarter, 251 is 0.0014 percent (derived). Counted by volume the picture differs. The post says Mirai classified traffic made up 46.5 percent of all mitigated network layer bytes in the quarter, out of 272.6 PB in total, and peaked in August at 57.23 PB. Those two figures sit in one sentence and do not obviously match: 57.23 PB is 21.0 percent of 272.6 PB (derived), so the 46.5 percent most plausibly describes the whole quarter's Mirai classified bytes, about 126.8 PB (derived), which is an inference because the post does not spell it out. Mirai classified is a label Cloudflare puts on traffic. The post does not say which named botnets that traffic came from.

Zoom

One more bucket is easy to confuse with the swarm. The post says the short burst, mid range, high count attacks are the signature of booter services, the hired attack services, and that they mainly hit computer software, gambling and casinos, and information technology. Its chart for that group is captioned with a pool of 1.69 million short duration, mid rate attacks, which is 9.3 percent of the 18.2 million (derived), and no thresholds for mid rate are printed. So the booter attribution applies to a subset the post does not define, and it is stated as a characterisation, with no evidence about who ordered the attacks.

The botnet takedown: what the post claims and what it cannot show

The post says the fall in giants is "possibly a reflection of law enforcement actions" against four major IoT botnets earlier in the year. Further down it says the drop is "coinciding with law enforcement action in early 2026" that dismantled four of the largest IoT DDoS botnets, and names them: Aisuru, KimWolf, JackSkid and Mossad. It links a US Attorney's Office release for the action. This briefing could not open that release, so what the action did is taken from Cloudflare's wording only. The link's own address uses the word disrupt, where the post's text says dismantled.

Timing is the limit on the claim. The action is dated only as early 2026. The half year report put 805 attacks above 1 Tbps in Q2, a more than sixfold rise over Q1, and the post under study puts 251 in Q3. If the action came in the first quarter, the Q2 surge followed it, so the Q3 fall cannot be pinned on it from these figures. Cloudflare's own word is possibly, and nothing in the post tests the idea against, for example, the activity of the other botnets or a change in attacker choices. The half year report gives a different candidate for the decline in activity after April, an international action against attack for hire users. Nothing in either report establishes which, if either, mattered.

The post's own caution points the other way: it says variants "continue to emerge" and names two, Dysphoria and Evooo1Bot. Secondary reporting gives a little more, attributed to the researchers who found them. BleepingComputer, citing a threat research team, reported on 27 July 2026 that Dysphoria had compromised around 200,000 devices and evolved from the JackSkid and fbot malware, and that its operators claim a maximum capacity of 4 Tbps, which is a claim and not a measurement. It also reported on 15 August 2026 a Mirai based modular Linux botnet, Evooo1Bot, which reuses the leaked Mirai attack engine, citing Fortinet. Both are secondary accounts of other companies' research, and neither was tied by Cloudflare to its own counts. If JackSkid code lives on in a successor, the takedown removed a name and not necessarily the capability.

The vectors: a share is not a count

The post says attackers were "abruptly abandoning CLDAP floods", which it says collapsed by 99.5 percent quarter on quarter, and pivoted to DNS amplification, up 215 percent, and general UDP floods, up 122 percent. Cloudflare's own graphic labels those percentages as a relative change in the share of attack counts, not in the number of attacks. Because the total rose 37.9 percent, the counts moved further than the shares. The table sets the printed shares beside counts this briefing worked out by multiplying each share by the quarter's total (derived, approximate, since the shares and totals are rounded).

Zoom

Three readings follow, each from the figures and not from the post's prose. The DNS flood is still the largest single vector by count, at 39.26 percent, and DNS based attacks together are 42.7 percent (derived), up from about 41.1 percent in Q2 (derived from the same graphic). The four vectors in the graphic add to 74.05 percent (derived), so about a quarter of network layer attacks are in vectors the post does not itemise. And by bytes the order changes: other UDP floods carry 36.40 percent of the bytes, while DNS floods, the biggest by count, carry 2.86 percent.

Why CLDAP collapsed is not stated. The post describes the mechanism, forged requests to public domain controllers on UDP port 389, and then reports the fall. It offers no cause: not a fix, not the takedown, not a change in how Cloudflare classifies traffic. A drop from about 1.35 million attacks to about 9,000 in one quarter (derived) is large enough that a classification or measurement change would be a reasonable thing to ask about, and the post does not address it.

Targets: ranks without a printed metric

The post ranks the ten most attacked industries and locations in two graphics and moves on. It does not say whether a rank is by attacks, requests or bytes, or how a location is assigned. The half year report ranked industries and countries by share of mitigated HTTP requests, and the only share the new post prints is Indonesia's 2.93 percent of total attacks. Where it explains a rise, it sets events beside it: Canada from 16th to 6th amid trade disputes, and Israel up seven places in mid September, in a period the post describes as marked by contentious decisions ahead of parliamentary elections. These are associations. No attacker is named and no motive is established.

What the post leaves out matters as much as the ranks. It has no section on where attacks came from: the half year report named Brazil as the top source country, and the new post names none. It reports no ransom or extortion demands, no largest attack and no peak rate for the quarter, and no outage or downtime at any target. The post says the share of Media, Production and Publishing is "roughly a quarter of its Q2 level", which means the top rank rests on a much smaller share than before; the post does not print either share. A rank with no printed share tells a reader who is first, not by how much.

Stated and not stated: the record, line by line

The table sets what the Cloudflare post states against what it does not. Not stated means not found in the post's text or in its eight images, read in full. It does not mean the information does not exist at Cloudflare.

Friendly names: autonomous, swarm, mitigated

Three labels in the post do the work of evidence. Autonomous is the first. The post says "Autonomy is the point" and that Cloudflare's systems detect and mitigate attacks without human intervention. That describes how Cloudflare stops an attack on its own network. It is not a control that a reader's own service has, unless the service sits behind it, and Cloudflare's protection documentation says it provides the protection to all customers on all plans.

Mitigated is the second. The count is of attacks Cloudflare says it mitigated. The post reports no measure of whether mitigation was complete, how long it took, or whether any customer saw degraded service. The half year report says that even a short burst can trigger routing instability, retransmissions and timeouts that take hours or days to resolve, which is Cloudflare's statement and not a measured result in this edition.

Swarm is the third, and it is a metaphor that suggests coordination. In the post it is a bucket of short, small attacks, and a count of them says nothing about whether one actor or many launched them. An hourly rate of 8,226 invites a reader to picture a siege on a service. The rate is the whole of a network that Cloudflare says protects more than 20 percent of the web, so it is not a rate of attack on any one reader.

What an operator can do on the strength of the report

Two things the report does not support. It does not discuss rate limiting per source, and a swarm of many sources would limit what that could do, so nothing here is an endorsement of it. And it gives no data on how often a given organisation is attacked, so the choice of how much to spend on protection cannot be read from a rate of 8,226 an hour.

Technical details

The Q3 report prints no indicators of compromise: no hashes, domains, addresses or file names. It prints protocol and botnet names, and Cloudflare's developer pages print the access details of the feed it recommends to service providers. The blocks below are copied exactly from the pages read on 31 October 2026.

The botnet names as printed in the Q3 post. These are the four botnets Cloudflare links to the law enforcement action. A defender should treat them as names to search for in threat intelligence, not as detections.

Aisuru, KimWolf, JackSkid, and Mossad

How a CLDAP reflection attack works, in the half year report's words. The step a defender controls is whether a directory service answers the public internet on this port.

CLDAP attacks work by sending small spoofed queries to publicly reachable domain controllers on UDP port 389; the servers reply to the spoofed source (the victim) with responses tens to hundreds of times larger than the original query, thus overwhelming the victim host.

How Cloudflare's feed for service providers counts and authorises, as printed on its developer page. An offense is one mitigated HTTP request from one address, and the account level permission needed to read the feed is the last line.

Each offense is a mitigated HTTP request from the specific IP address. For example, if an IP has 3,000 offenses, it means that Cloudflare has mitigated 3,000 HTTP requests from that IP.
DDoS Botnet Feed > Read

The arithmetic behind the derived figures in this briefing. Inputs are the printed figures named in each line. These lines were worked out by this site and are not from Cloudflare.

37.9 percent quarter on quarter = 18.2 / 13.2 - 1
208.5 percent year on year    = 18.2 / 5.9 - 1
8,243 an hour from 18.2 million = 18,200,000 / (92 x 24); the post prints 8,226, which implies 18.16 million
68.8 percent fall in giants   = 1 - 251 / 805
about 130 giants in Q1       = 935 - 805
at least 94 percent short and small = 96 + 98 - 100
Mirai bytes, quarter          = 46.5 percent x 272.6 PB = about 126.8 PB; August 57.23 PB is 21.0 percent of 272.6 PB

The question the figure does not answer

Cloudflare's report is a measurement of one network by the company that sells protection on it, and it is careful in some places and loose in others: the 208 percent that attaches to two different subjects, the 38 percent that is not printed, the takedown that fits a fall and a rise equally well. The figures that survive the reading are the plain ones. Attacks counted on Cloudflare's network rose to 18.2 million, almost all were short and small, and the very large ones were fewer than in Q2 but not fewer than in Q1.

The question the report cannot answer is the one that matters to a reader. If an attack against your service began and ended inside 10 minutes tonight, which control would have acted, how would you know, and who would have been told?

Key facts